Amatera Infostealer: A Deep Dive into Its Operations and Impact

30 October 2026 4 min read هدهد تك | Hudhud Tech

Amatera, an infostealer that topped ESET’s detections in Latin America in the first half of 2026, illustrates the professionalization of cybercrime. This malware targets victims globally and highlights the evolving landscape of cyber threats.

Infostealers like Amatera are designed to extract a wide range of sensitive data, including login credentials, session cookies, tokens, cryptocurrency wallet information, and files from development environments. The extensive data they collect can lead to account hijacking, financial fraud, and unauthorized access to organizational networks.

Overview of Amatera

Identified by ESET as Win/PSW.Amatera, this Windows infostealer, written in C++, was first observed in 2024. It operates under a malware-as-a-service (MaaS) model, where its developers maintain the software and infrastructure while affiliates pay a subscription fee to use it in their campaigns.

Amatera is believed to be a rebranding of ACR Stealer, which itself is an updated version of the GrMsk stealer, as noted in a Sekoia investigation from May 2024. Rebranding is a common practice in the MaaS ecosystem, allowing malware developers to evade detection and continue their operations.

By late 2024, Amatera was available for $199 per month, with support provided through Telegram.

Capabilities of Amatera

Amatera is capable of extracting credentials stored in web browsers, including cookies, browsing histories, and session tokens. It can also access sensitive documents synced with OneDrive or SharePoint. Microsoft reported a surge in attacks on its enterprise customers between late April and mid-June 2026, attributed to this malware.

The malware is continuously developed and appears as the final payload in various attack chains, reflecting the flexibility of the MaaS model. Affiliates choose their own delivery methods, which include compromised websites, search engine ads, targeted emails, fake documents, and ClickFix techniques.

ClickFix, a social engineering tactic first documented in 2024, has become a key delivery vector for Amatera. Victims are often tricked into executing commands that initiate the compromise process. Variants of ClickFix include:

AI-fix: Pages impersonating legitimate AI services, providing fake troubleshooting content.
CrashFix: Fake ads that trigger browser crashes, prompting victims to seek a malicious fix.
ConsentFix: Tricks victims into providing OAuth tokens for unauthorized access to their Microsoft accounts.

Amatera has also exploited compromised WordPress sites, gaining access through weak credentials or vulnerabilities in themes and plugins.

In Latin America, Amatera led ESET’s infostealer detections in early 2026, surpassing other malware like Formbook and Vidar. The growth of ClickFix as an attack vector saw a 500% increase in detections in early 2025, followed by a decline and a resurgence in 2026 as attackers adapted their strategies.

Risks of Amatera Compromise

The potential consequences of an Amatera compromise include:

Unauthorized access to personal or corporate accounts through stolen credentials.
Theft of cryptocurrency assets when wallet information is exposed.
Infrastructure compromise via SSH keys or development secrets.
Installation of additional malware.
Use of compromised accounts for fraud or further intrusions.

The risk extends to employers, especially when victims mix personal and work profiles in the same browser. Stolen information can serve as a gateway for further attacks.

Preventing and Responding to Compromise

To mitigate risks, especially in corporate settings, the following measures are recommended:

Be cautious of any legitimate CAPTCHA or error message that asks for command execution.
Implement application control rules to limit the use of system interpreters.
Monitor unusual activities in PowerShell and other system tools.
Utilize phishing-resistant authentication methods.
Keep personal and work profiles separate.
Filter suspicious sites and downloads initiated from ads.

If a compromise is confirmed, isolating the affected device is crucial. From a trusted device, revoke active sessions, reset passwords, and review access to sensitive applications.

Amatera exemplifies the current state of the infostealer market, where developers maintain the malware while affiliates distribute it through various channels. The threat posed by stolen data can persist long after the initial compromise, highlighting the need for ongoing vigilance against evolving cyber threats.

Source: ESET WeLiveSecurity

What do you think of this story?